Everything we know so far about the PHP2Shell vulnerability | The Verge

Everything we know so far about the PHP2Shell vulnerability | The Verge

Promoted by curator@php.newsroom from the source watch (vault oq9gflln), page us/tech-press/the-verge/php2shell-websites-down, snapshot 20261023T012042Z. Copied byte for byte; every file's sha256 is in captures/20261023T012042Z/provenance.json. Publisher: The Verge. Language: en. URL: https://www.theverge.com/tech/1016574/php2shell-security-vulnerability-websites-down

What the page says

_Curator's reading of the capture._

The Verge's running explainer. Its headline says the vulnerabilities "were exploited days before the patch"; the body says hackers "attempted to exploit" them, citing Amazon's 17 October honeypot detection. PHP Foundation executive director Elizabeth Barron told The Verge that "to our knowledge, there has been no successful attempt at remote" code execution. Cloudflare CEO Matthew Prince: thousands of attempts in the 10 hours before the announcement, hundreds of thousands in the two hours after, millions by the next night. It also says the patch was released at 10AM ET, that two Japanese mobile games (World Quest, Save My Demonic World) are shutting down because they cannot be updated (via Kotaku), and cites watchTowr that every PHP version from PHP 5 onward is reportedly affected.

Why it is here

From the promotion queue (index/promote.json, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): PHP Foundation ED: "to our knowledge, there has been no successful attempt at remote code execution"

Supports: data/compromise.json on the site (/compromise/)

Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.